# DF-3834 — Inverted KASSERT in bwn_phy_lp_tblinit_r2 (`rev < 2` must be `rev >= 2`) — guaranteed panic at PHY init on INVARIANTS kernels

- File: `sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c` (pass 2)
- Class: CWE-617/CWE-588 unreachable-assert inversion → kernel panic at attach/init
- Severity: Low (INVARIANTS-only: `KASSERT` compiles to nothing on stock GENERIC,
  sys/sys/systm.h:117; bwn **is** compiled into X86_64_GENERIC, sys/config/X86_64_GENERIC:268)
- Hardware-gated: fires for every LP PHY rev ≥ 2 device (b2063 radios, e.g. BCM4313/43225-class)
- Upstream-inherited: FreeBSD head `sys/dev/bwn/if_bwn_phy_lp.c` carries the same inverted
  assertion in its `bwn_phy_lp_tblinit_r2`.

## Build / Run / Expected
Hardware-gated (env.txt: no Broadcom wireless on the audit guest). On an INVARIANTS kernel with
an LP PHY rev ≥ 2 card, simply bringing the interface up panics:

    kldload bwn.ko / boot with the card   # attach
    ifconfig bwn0 up                      # bwn_init -> bwn_chipinit -> mac_phy.init

Expected: `panic: assertion "mac->mac_phy.rev < 2" failed in bwn_phy_lp_tblinit_r2 at ...:2742`.

## Root cause
`bwn_phy_lp_tblinit` dispatches on revision — if_bwn_phy_lp.c:1262-1270:

        if (mac->mac_phy.rev < 2) {
                bwn_phy_lp_tblinit_r01(mac);     /* its KASSERT(rev < 2) is correct:2527 */
                ...
                return;
        }
        bwn_phy_lp_tblinit_r2(mac);              /* reached ONLY when rev >= 2 */

but `bwn_phy_lp_tblinit_r2` opens with — if_bwn_phy_lp.c:2742:

        KASSERT(mac->mac_phy.rev < 2, ("%s:%d: fail", __func__, __LINE__));

which contradicts its only call condition. The companion writers get it right
(`bwn_phy_lp_gaintbl_write_r2`: `KASSERT(rev >= 2)`, line 3661). The assertion is inverted.